OS X Lion Artifacts v1.0
 Share
The version of the browser you are using is no longer supported. Please upgrade to a supported browser.Dismiss

 
$
%
123
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
|
 
Still loading...
ABCDEF
1
OS X Lion Artifacts By: Sean Cavanaughscavanaugh@appleexaminer.comWant to add to the list? Email artifact info to scavanaugh@appleexaminer.com
2
Last Modified: 12/19/2011 - added some links to helpful articlesTwitter: @spcavanaughhttp://tinyurl.com/63l2l6khttps://docs.google.com/spreadsheet/ccc?key=0AkBdGlxJhW-ydDlxVUxWUVU0dXVzMzUxRzh2b2ZzaFE&hl=en_US#gid=0
3
ArtifactNamePathNotes
4
5
User Directories
6
Downloads DirectoryDownloads/Users/<user>/Downloads/
7
Documents DirectoryDocuments/Users/<user>/Documents/
8
Music DirectoryMusic/Users/<user>/Music/
9
Desktop DirectoryDesktop/Users/<user>/Desktop/
10
Library DirectoryLibrary/Users/<user>/Library/Hidden directory in Lion
11
Movies DirectoryMovies/Users/<user>/Movies/
12
Pictures DirectoryPictures/Users/<user>/Pictures/
13
Public DirectoryPublic/Users/<user>/Public/
14
Sites DirectorySites/Users/<user>/Sites/
15
ApplicationsApplications/Users/<user>/Applications/
16
ApplicationsApplications/Applications/Not user-specific
17
18
19
Safari
20
Safari BookmarksBookmarks.plist/Users/<user>/Library/Safari/Bookmarks.plistPlist listing default and user-added Safari bookmarks
21
Safari DownloadsDownloads.plist/Users/<user>/Library/Safari/Downloads.plistPlist listing files downloaded using Safari Browser
22
Safari Installed ExtensionsExtensions.plist/Users/<user>/Library/Safari/Extensions/Extensions.plistPlist describing installed Safari Extensions
23
Safari ExtensionsExtensions/Users/<user>/Library/Safari/Extensions/Directory of Safari Extensions. Safari Extensions utilize .safariextz file extension.
24
Safari HistoryHistory.plist/Users/<user>/Library/Safari/History.plistPlist listing Safari web browsing history
25
Safari History IndexHistoryIndex.sk/Users/<user>/Library/Safari/HistoryIndex.skAn index of Safari History allowing a user to perform keyword searches of visited webpages
26
Safari Last SessionLastSession.plist/Users/<user>/Library/Safari/LastSession.plistA plist describing the state of Safari when it was last closed
27
Safari Local Storage DirectoryLocalStorage/Users/<user>/Library/Safari/LocalStorage/A directory for webpage-specific storage. Each webpage stores data in a SQLite database with the file extension of .localstorage.
28
Safari Local Storage DatabaseStorageTracker.db/Users/<user>/Library/Safari/LocalStorage/StorageTracker.dbA database listing the webpage specific databases
29
Safari Saved Desktop ImageSafari Desktop Picture.jpg/Users/<user>/Library/Safari/Saved Desktop Picture.jpgWill persist in directory after desktop picture has been changed to something else
30
Safari Top SitesTopSites.plist/Users/<user>/Library/Safari/TopSites.plistA Plist listing the webpages belonging to a Safari's Top Sites
31
Safari Webpage Icons DatabaseWebpageIcons.db/Users/<user>/Library/Safari/WebpageIcons.dbA database containing saved web page icons for webpages visited
32
Safari Webpage DatabasesDatabases/Users/<user>/Library/Safari/Databases/A directory for webpage-specific database storage
33
Safari Webpage Databases DatabaseDatabases.db/Users/<user>/Library/Safari/Databases/Databases.dbA database that keeps track of stored webpage-specific databases
34
Safari Cache Directorycom.apple.Safari/Users/<user>/Library/Caches/com.apple.Safari/A directory containing Safari-specific cache items
35
Safari CacheCache.db/Users/<user>/Library/Caches/com.apple.Safari/Cache.dbA cache of data from visited webpages
36
Safari Extensions CacheExtensions/Users/<user>/Library/Caches/com.apple.Safari/Extensions/A directory containing cached items for Safari Extensions
37
Safari Webpage PreviewsWebpage Previews/Users/<user>/Library/Caches/com.apple.Safari/Webpage Previews/A directory containing images of viewed webpages in .png and .jpg formats. The file name is a hash of the webpage URL.
38
Safari CookiesCookies.plist/Users/<user>/Library/Cookies/Cookies.plistA Plist containing cookies from visited webpages
39
Safari Preferencescom.apple.Safari.plist/Users/<user>/Library/Preferences/com.apple.Safari.plistContains recent safari search strings and downloads folder location in addition to preferences
40
Safari Saved Application State Directorycom.apple.Safari.savedState/Users/<user>/Library/Saved Application State/com.apple.Safari.savedState/
41
Safari Bookmark CacheBookmarks/Users/<user>/Library/Caches/Metadata/Safari/Bookmarks/Each bookmark entry in Bookmarks.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow the user to select the bookmark entry from Spotlight and have Safari launch the corresponding webpage
42
Safari History CacheHistory/Users/<user>/Library/Caches/Metadata/Safari/History/Each website entry in History.plist is stored as an individual file in this directory for more efficient use with Spotlight and to allow the user to select the webpage entry from Spotlight and have Safari launch the corresponding webpage
43
44
45
Mail
46
Mail CacheCache.db/Users/<user>/Library/Caches/com.apple.Mail/Cache.dbCached images from email messages
47
Mail Mailbox DirectoryMailboxes/Users/<user>/Library/Mail/V2/Mailboxes/Apple Mail Mailboxs
48
Mail IMAP Synched MailboxesIMAP-<name@address>/Users/<user>/Library/Mail/V2/IMAP-<name@address>Synched IMAP Account(s)
49
Mail POP Synched MailboxesPOP-<name@address>/Users/<user>/Library/Mail/V2/POP-<name@address>Synched POP Account(s)
50
Mail BackupTOCBackupTOC.plist/Users/<user>/Library/Mail/V2/MailData/BackupTOC.plistBackup Plist that defines the mailbox structure
51
Mail Envelope IndexEnvelop Index/Users/<user>/Library/Mail/V2/MailData/Envelope IndexKeeps track of the location of Mail messages - the content of some messages is present as well
52
Mail Opened AttachmentsOpenedAttachments.plist/Users/<user>/Library/Mail/V2/MailData/OpenedAttachments.plistPlist listing opened Mail attachments
53
Mail Search HistorySearchHistory.plist/Users/<user>/Library/Mail/V2/MailData/SearchHistory.plistPlist listing search terms entered into Mail's search box
54
Mail Signatures by AccountSignaturesByAccount.plist/Users/<user>/Library/Mail/V2/MailData/Signatures/SignaturesByAccount.plistPlist containing Mail signatures
55
Mail Smart Mailbox InfoSmartMailboxes.plist/Users/<user>/Library/Mail/V2/MailData/SmartMailboxes.plistSmart Mailbox information
56
Mail RSS FeedsRSS/Users/<user>/Library/Mail/V2/RSS/Directory containing RSS feed mailboxes
57
Mail Downloads DirectoryMail Downloads/Users/<user>/Library/Mail Downloads/Directory containing files downloaded from email messages
58
Mail Preferencescom.apple.Mail.plist/Users/<user>/Library/Preferences/com.apple.Mail.plistMail preferences
59
Mail Recent ContactsMailRecents-v4.abcdmr/Users/<user>/Library/Application Support/Address Book/MailRecents-v4.abcdmrSQLite database stored in Address Book's support directory containing recent Mail contacts
60
61
62
iChat
63
iChat Preferencescom.apple.iChat.plist/Users/<user>/Library/Preferences/com.apple.iChat.plistiChat preferences and user account information
64
Saved ChatsiChats/Users/<user>/Documents/iChats/
65
IconPictures/Users/<user>/Library/Caches/com.apple.iChat/PicturesUser iChat icon
66
Recent PicturesiChat Recent Pictures/Users/<user>/Library/Images/iChat Recent Pictures/Recent user iChat pictures
67
iChat AIM Plistcom.apple.iChat.AIM.plist
68
iChat Jabber Plistcom.apple.iChat.Jabber.plist
69
iChat Yahoo Plistcom.apple.iChat.Yahoo.plist
70
iChat Status Messages Plistcom.apple.iChat.StatusMessages.plist
71
iChat PubSub Plistcom.apple.iChat.PubSub.plist
72
73
74
iPhoto
75
iPhoto LibraryiPhoto Library /Users/<user>/Pictures/iPhoto LibrarySpecialized folder that contains user's iPhoto pictures
76
Original PhotosOriginals/Users/<user>/Pictures/iPhoto /Library/Originals/Contains original versions of all photos
77
Modified PhotosModified/Users/<user>/Pictures/iPhoto /Library/Modified/Contains modified versions of photos
78
iPhoto Main DatabaseiPhotoMain.db /Users/<user>/Pictures/iPhoto /Library/iPhotoMain.dbContains detailed information about iPhoto library
79
iDevice Photo CacheiPod Photo Cache/Users/<user>/Pictures/iPhoto /Library/iPod Photo Cache/Directory of folders containing .ithmb photos synced to iDevice. Folder modified date/time stamp updated upon sync.
80
Face Recognition Artifactsface.db, face_blob.db/Users/<user>/Pictures/iPhoto /Library/SQLite databases containing data about recognized faces
81
Album DataAlbumData.xml/Users/<user>/Pictures/iPhoto /Library/AlbumData.xmlPlist containing information about some iPhoto albums/events and path/photo ID info for each picture in the library
82
Album Data 2AlbumData2.xml/Users/<user>/Pictures/iPhoto /Library/AlbumData2.xmlPlist containing information about some iPhoto albums/events and other iPhoto information
83
iPhoto Spotlight FileiPhoto.ipspot/Users/<user>/Pictures/iPhoto /Library/iPhoto.ipspot
84
iPhoto Recent Itemscom.apple.iPhoto.LSSharedFileList.plist/Users/<user>/Library/Preferences/com.apple.iPhoto.LSSharedFileList.plistiPhoto Recent Items - typically only contains iPhoto Library package
85
iPhoto Preferencescom.apple.iPhoto.plist/Users/<user>/Library/Preferences/com.apple.iPhoto.plistiPhoto preferences
86
iPhoto Trash - See Apple Examiner paperhttp://www.appleexaminer.com/files/iPhoto_Trash_Analysis.pdf
87
88
89
iTunes
90
iTunes Preferencescom.apple.iTunes.plist/Users/<user>/Library/Preferences/com.apple.iTunes.plistiTunes preferences
91
iTunes Library DirectoryiTunes/Users/<user>/Music/iTunes/iTunes library directory
92
iTunes MediaiTunes Media/Users/<user>/Music/iTunes/iTunes Media/Directory containing iTunes media files
93
iTunes Library StructureiTunes Music Library.xml/Users/<user>/Music/iTunes/iTunes Music Library.xmlXML file defining the iTunes music library
94
95
96
Photo Booth
97
Recent PicturesRecents.plist/Users/<user>/Pictures/Photo Booth /Library/Recents.plistA Plist listing the recent photos and videos taken using Photo Booth. Items deleted by the user will not be saved to this list.
98
Photo Booth Pictures DirectoryPictures/Users/<user>/Pictures/Photo Booth /Library/Pictures/A directory containing the user's Photo Booth pictures
99
Cachecom.apple.PhotoBooth/Users/<user>/Library/Caches/com.apple.PhotoBooth/Photo Booth cache directory
100
Photo Booth Preferencescom.apple.PhotoBooth.plist/Users/<user>/Library/Preferences/com.apple.PhotoBooth.plistPhoto Booth preferences
Loading...
 
 
 
Sheet1
Sheet2
Sheet3